Itay Glick: VP of Products at OPSWAT, has provided six initial lessons that organizations can learn from the recent crisis created by the failed CrowdStrike update.
These are as follows:
Recognize universal vulnerability: understand that vulnerabilities can affect any organization. No software, including endpoint detection and response (EDR) solutions, is immune to potential issues, whether from a regular update or an automatic software update.
Map critical devices: ensure you have a comprehensive map of critical devices within the organization. Know their locations, functions, and the impact of each device on your operations.
Audit installed applications: identify and justify the applications installed on critical devices. Evaluate if all applications are necessary and look for opportunities to minimize the number of installed applications to reduce the attack surface.
Manage automatic updates: determine which applications are performing automatic updates and assess if these updates are essential. Evaluate the necessity and impact of these updates to ensure they do not introduce vulnerabilities.
Implement redundant update groups: configure updates to be applied in redundancy groups, ensuring that updates can be rolled out and tested in smaller, controlled segments before being deployed organization-wide.
Develop a robust disaster recovery plan: define a clear disaster recovery (DR) plan. Establish recovery point objectives (RPO) and recovery time objectives (RTO) for each critical asset, ensuring the organization can quickly recover from incidents with minimal impact on operations.
